Correct Answer:

DES is correct.

DES is the only symmetric algorithm listed.

Incorrect Answers:

SHA-1, Diffie-Hellman, and ECC are incorrect.

None of these options is a symmetric algorithm.

Correct Answer:

Cain is correct. Cain (and Abel) can do all sorts of great stuff, including extracting voice from VoIP captures.

Incorrect Answers:

Black Widow, Netcat, and Nmap are incorrect.

The remaining answers do not perform the task listed. Black Widow copies websites to your system for later review.

Netcat can be used for all sorts of things but is mostly known for its use in creating backdoor access to compromised systems.

Nmap is probably the best-known port scanner in the world.

Correct Answer:

It is used to gather information about attackers is correct.

Honeypots are placed on a network by design to observe bad guys at work. The idea is the security staff can observer the details of how the attacker gets in, moves around, and what he aims at.

Incorrect Answers:

It prevents malware on the network, it controls systems in a DDoS attack, and it obscures legitimate internal users from external view are incorrect.

Honeypots are not antivirus systems, firewalls, proxies, or botnet controllers.

Correct Answer:

GLBA is correct. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to take steps to protect customer information. It also forces them to provide their privacy practices to the public.

Incorrect Answers:

HIPAA, Sarbanes-Oxley, and PCI DSS are incorrect.

HIPAA deals with the protection of personal data in the medical realm.

Sarbanes-Oxley (SOX) deals with publicly traded companies, forcing them to allow independent audits and to post financial findings.

PCI DSS is in place to secure data used inc redit card transactions and storage.

Correct Answer:

Kismet is correct.

Per EC-Council, Kismet works as a true passive network discovery tool, with no packet interjection whatsoever. Kismet will work with any wireless card that supports raw monitoring (rfmon) mode, and (with appropriate hardware) it can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet also works by “channel hopping” to discover as many networks as possible and also has the ability to sniff packets and save them to a log file, readable by Wireshark or tcpdump.

Incorrect Answers:

NetStumbler, aircrack, and netsniff are incorrect.

NetStumbler is an Active Discovery tool.

Aircrack is a WEP-cracking program.

Netsniff is a false choice.

Correct Answer:

Time exceeded is correct.

Type 11, Code 0 is used for “time exceeded” messages. These are usually generated by a gateway along the way to let the sender know the time-to-live field has reached zero.

Incorrect Answer:

Redirect, ECHO request, and ECHO return are incorrect.

ECHO request and ECHO return are Types 8 and 0, respectively.

Redirect is Type 5.

Correct Answer:

Spear phishing is correct. Spear phishing is an e-mail fraud attempt that targets a specific group of people or organization.

Incorrect Answers:

Phishing, watering hole attack, and impersonation are incorrect.

While phishing is involved here, the fact that the attack is targeting a specific group makes it spear phishing.

A watering hole attack involves an attacker poisoning websites he knows group members frequent.

Impersonation encompasses a variety of social engineering attempts and occurs when an attacker pretends to be a person of authority.

Correct Answer:

Ip.addr==64.83.15.18 && tcp contains HR_admin is correct.

This is the only answer in correct Wireshark syntax. Definitely know the ip.addr, ip.src, and ip.dst filters. The “tcp contains” filter is another favorite of test question writers.

Incorrect Answers:

Ip.addr 64.83.15.18 && “HR_admin”, ip.addr 64.83.15.18 && tcp string==HR_admin, and ip.addr==64.83.15.18 + tcp contains HR_admin are incorrect.

These answers are incorrect syntax for Wireshark filters. A good way to learn the syntax of these filters is to use the expression builder directly beside the filter entry box.

Correct Answer:

RoT is correct.

Roots of Trust are hardware or software components that are inherently trusted by the OS. They are usually trusted to perform security-critical functions (like protection of cryptographic keys and device authentication). Boot firmware is an example.

Incorrect Answers:

OST, SOA, and API are incorrect.

OST does not exist.

Service Oriented Architecture (SOA) is an architectural pattern in software design where application components provide services to other components over a network.

An application programming interface (API) is a set of routines, protocols, and tools for building software applications that specifies how software components should interact.

Correct Answer:

It is sending SMS texts to a user in an effort to trick them into downloading malicious code is correct.

Smishing comes from cramming SMS (texting) and phishing together. “Smishing,” get it? The idea is the same as with phishing, except you use text messaging to trick users into downloading stuff.

Incorrect Answers:

It is sniffing Bluetooth connections, it is hijacking Bluetooth connections to send text messages, and tt is rooting an Android device are incorrect.

These descriptions do not apply to smishing.